System and Method for Information Lifecycle Management of Investigation Cases

ABSTRACT

Various agencies, such as law enforcement and intelligence agencies, deploy monitoring centers that monitor communication networks and analyze the monitored communication. One possible way to reduce storage cost is to apply Information Lifecycle Management (ILM) techniques, which store the content to multiple storage tiers having different performance levels. The monitoring center processes the various items of content in the context of investigation cases. given investigation case may be assigned a certain status, e.g., active or closed. The monitoring center comprises an ILM server that assigns content items to storage tiers based on the investigation cases with which the content items are associated. The ILM server may analyze the state of a given investigation case, and selects an ILM policy based on the state of the case. The ILM policy specifies the storage tier (or tiers) to be used for storing items of data associated with the case.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to data management, andparticularly to methods and systems for information lifecyclemanagement.

BACKGROUND OF THE DISCLOSURE

Various data management systems use Information Lifecycle Management(ILM) techniques for administrating the storage of data over time.Example ILM techniques are described in U.S. Patent ApplicationPublication 2006/0004847, whose disclosure is incorporated herein byreference.

SUMMARY OF THE DISCLOSURE

An embodiment that is described herein provides a method for InformationLifecycle Management (ILM). The method includes analyzing a state of aninvestigation case and selecting, based on the analyzed state, an ILMpolicy for applying to items of data associated with the investigationcase. The items of data are stored in a storage system having multiplestorage tiers having different, respective performance levels, inaccordance with the ILM policy.

In some embodiments, selecting the ILM policy includes choosing arespective storage tier for storing each item of data. In an embodiment,selecting the ILM policy includes identifying an activity status of theinvestigation case, and choosing the storage tier depending on theactivity status. In a disclosed embodiment, the performance levels ofthe multiple storage tiers include different, respective access times.

In some embodiments, the items include content that is derived fromcommunication sessions conducted over a communication network andmetadata associated with the content. In an embodiment, the metadataincludes references to a current storage location of the associatedcontent in the storage system. In another embodiment, the items includeadditional items of data from an external source separate from thecommunication network.

In yet another embodiment, storing the items in accordance with the ILMpolicy includes storing the items in a first storage tier having a firstperformance level when the investigation case is active, and storing theitems in a second storage tier having a second performance level, lowerthan the first performance level, when the investigation case isinactive. In still another embodiment, storing the items in accordancewith the ILM policy includes detecting a change in the state of theinvestigation case, and moving the items from a first storage tier to asecond storage tier in response to the change. In a disclosedembodiment, the items include content and metadata associated with thecontent, and moving the items includes moving only the content and notthe metadata of the items, and updating the metadata of the items toreflect a current storage location of the items in the second storagetier.

In an embodiment, the investigation case is one of multipleinvestigation cases that are assigned respective priorities, and storingthe items in accordance with the ILM policy includes choosing a storagetier for storing the items depending on a priority assigned to theinvestigation case. In another embodiment, selecting the ILM policyincludes choosing a storage tier for storing the items depending on aparent case or on a sub-case of the investigation case. In yet anotherembodiment, selecting the ILM policy includes selecting a storage tierfor storing the items based on timing profiles according to which thedata items associated with the investigation case were accessed.

In some embodiments, storing the items in accordance with the ILM policyincludes copying content of all the items associated with theinvestigation case from a first storage location to a second storagelocation in a single transaction, updating metadata associated with theitems following the transaction to indicate the second storage location,and, after updating the metadata, deleting the content from the firststorage location. In an embodiment, the method includes rolling back thetransaction upon failing to successfully complete the transaction or toupdate the metadata.

There is additionally provided, in accordance with an embodiment that isdescribed herein, apparatus for Information Lifecycle Management (ILM)including a storage system and a processor. The storage system includesmultiple storage tiers having different, respective performance levels.The processor is configured to analyze a state of an investigation case,to select, based on the analyzed state, an ILM policy for applying toitems of data that are associated with the investigation case, and tostore the items of data in the storage tiers of the storage system inaccordance with the ILM policy.

The present disclosure will be more fully understood from the followingdetailed description of the embodiments thereof, taken together with thedrawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that schematically illustrates a monitoringcenter, in accordance with an embodiment of the present disclosure;

FIG. 2 is a block diagram that schematically illustrates an InformationLifecycle Management (ILM) server in a monitoring center, in accordancewith an embodiment of the present disclosure; and

FIG. 3 is a flow chart that schematically illustrates a method for ILM,in accordance with an embodiment of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENTS Overview

Various agencies, such as law enforcement and intelligence agencies,deploy monitoring centers that monitor communication networks andanalyze the monitored communication. A monitoring center typicallycomprises a large storage system, which stores raw content ofintercepted communication sessions as well as analysis products. In manypractical applications, a large volume of content has to be stored forlong periods of time—An example monitoring center may be required tostore several Terabytes of content for several years. The cost ofstorage devices that meet such requirements may be prohibitive.

One possible way to reduce storage cost is to apply InformationLifecycle Management (ILM) techniques, which store the content tomultiple storage tiers having different performance levels. For example,an ILM scheme may store some content on lower-cost but slower storagedevices, and other content on faster but higher-cost storage devices.Each type of storage device, which is characterized by a certaincost/access-time trade-off, is referred to herein as a storage tier. Inan example configuration, the storage system comprises three storagetiers: An on-line tier comprising Fibre-Channel (FC) disks, a mid-termstorage tier comprising Serial Advanced Technology Attachment (SATA)disks, and an archive tier comprising detachable storage media.

Embodiments that are described hereinbelow provide improved methods andsystems for ILM. In the disclosed techniques, the monitoring centerprocesses the various items of content in the context of investigationcases. In other words, each item of content is associated with one ormore investigation cases. A given investigation case may be assigned acertain status, e.g., active or closed. The monitoring center comprisesan ILM server that assigns content items to storage tiers based on theinvestigation cases with which the content items are associated.Typically, content that is associated with active investigation caseswill be stored on faster storage devices, and content that is associatedwith closed investigation cases will be stored on slower storagedevices.

In other words, the ILM server analyzes the state of a giveninvestigation case, and selects an ILM policy based on the state of thecase. The ILM policy specifies the storage tier (or tiers) to be usedfor storing items of data associated with the case. The ILM serverstores the items in accordance with the selected ILM policy. In atypical embodiment, the items comprise content and associated metadata.Typically, only the content is moved from one storage tier to another.The metadata comprises references to the current storage locations ofthe content in the storage system, and is updated whenever content ismoved between storage tiers.

A naïve ILM solution would be to select a storage tier for a givencontent item based on the last time this item was accessed, such thatonly recently-accessed items are stored on fast but expensive storagemedia. Such a naive solution, however, does not perform well in thecontext of investigation cases.

For example, an active investigation case often relates to multiplecontent items, some of which are old and accessed rarely, while othersare new and accessed recently. Similarly, a closed investigation casemay relate to a mixture of new and old content items. The disclosedtechniques can make all the content items related to an active casereadily accessible, regardless of their individual access history. As aresult, access time to content items of active cases is reduced. When aninvestigation case is closed, its content items can be moved to slow,low-cost storage, even though some of the items may be new andrecently-accessed. Thus, fast memory storage is used only when actuallyneeded, and system cost is reduced.

System Description

FIG. 1 is a block diagram that schematically illustrates a monitoringcenter 20, in accordance with an embodiment of the present disclosure.Monitoring center is connected to a communication network 22 andmonitors communication of users 24 who operate communication terminals28 over the network. Monitoring centers of this sort may be used, forexample, for tracking suspect users, for intelligence gathering or forany other suitable application. The system may be deployed, for example,by intelligence or government agencies, by law enforcement or publicsafety bodies, or by any other suitable party.

Network 22 may comprise, for example, a wireless (e.g., cellular)network such as a Global System for Mobile communications (GSM) network,a Universal Mobile Telecommunications System (UMTS) network, a WirelessLocal Area Network (WLAN—also referred to as Wi-Fi) or any othersuitable type of wireless communication network. In alternativeembodiments, network 22 may comprise a wireline network such as a PublicSwitched Telephone Network (PSTN), an Internet Protocol (IP) networksuch as the Internet or any other suitable type of wireline network.

Terminals 28 may comprise, for example, fixed or mobile phones,communication-enabled mobile computers or Personal Digital Assistants(PDAs), or any other suitable type of device having communicationcapabilities. Terminals 28 may communicate over network 22 in variousways. The embodiments described below refer mainly to telephone calls,but the disclosed techniques are applicable to various other kinds ofcommunication interaction, such as e-mail, chat, instant messaging andShort Message Service (SMS).

One or more probes 32 intercept the communication from network 22. Thetype of probe may vary, for example, depending on the type of networkand the means for connecting to the network. In the present example,probe comprises a passive IP or telephony probe. Additionally oralternatively, probes 32 may intercept the communication using activemethods, e.g., using commands in the network elements of network 22 toduplicate the communication of certain terminals 28 and send it to themonitoring center.

A mediation device 36 separates each intercepted communication sessioninto content and metadata. The content may comprise, for example,recorded voice, text, images, IP traffic or any other type of contentexchanged between users 24. The metadata of a given communicationsession may comprise any suitable parameters that are descriptive of thesession. In the present example, the communication sessions comprisetelephone calls and the metadata comprises Call Data Records (CDRs).

The content of the intercepted communication is stored in a storagesystem 40. In the present context, the term “content” is used to coverboth raw content that is extracted from the intercepted communication,as well as analysis products that are produced based on the extractedcontent. Both types of content are typically stored in system 40, andboth types can be stored using the disclosed techniques.

In some embodiments, storage system 40 stores additional informationrelating to the intercepted content, such as transcriptions of voicecontent and/or annotations written by analysts. Information of this sortmay change along the life-cycle of the case. For example, a month aftera call was recorded and transcribed, an analyst may discover the meaningof a certain code word used in that call and add this information to theannotations stored in system 40.

In some embodiments, the monitoring center may receive additionalinformation from other sources other than network 22, and relate thisinformation to one or more investigation cases. Such information maycomprise, for example, historical CDRs from service providers, financialtransactions from banks or credit card companies, or any other suitableinformation type. Information from external sources may comprisecontent—e.g., e-mail messages from mail server archives. In theseembodiments, information of this sort is also regarded herein as contentand/or metadata as appropriate, and the ILM techniques described hereinare applied to them based on their association with investigation cases.

System 40 comprises multiple storage tiers, such that each tiercomprises storage devices that are characterized by a certain accesstime. Typically, faster storage devices have higher cost, and viceversa. The multi-tier configuration enables the system to select theappropriate cost/access-time trade-off for each content item, whilemaintaining a manageable system cost. As will be explained below, eachitem of content is associated with one or more investigation cases, andthe selection of storage tier depends on this association.

In the embodiment of FIG. 1, storage system 40 comprises an on-linestorage tier 44, a mid-term storage tier 48, and an archive storage tier52. On-line storage tier 44 has the fastest but most expensive storagedevices among the storage tiers. In an example embodiment, tier 44comprises Fibre-Channel (FC) disks. Mid-term storage tier 48 maycomprise slower and lower-cost storage devices, such as Serial AdvancedTechnology Attachment (SATA) disks.

Archive storage tier 52 comprises even slower storage devices. In thepresent example, the archive storage tier comprises detachable storagedevices, such as detachable disk or tape drives, which are notpermanently connected to the monitoring center. In some embodiments,archive storage tier 52 comprises storage media that can be written oncebut read multiple times, sometimes referred to as Write Once Read Many(WORM) media As another example, archive storage tier 52 may compriseoptical storage devices such as CD-ROM or DVD. Additionally oralternatively, the archive storage tier may comprise storage media thatcan be written and read multiple times, sometimes referred to as WriteMany Read Many (WMRM) media.

In alternative embodiments, system 40 may comprise any suitable numberof storage tiers, each having any suitable type of storage devices. Anysuitable storage media can be used for implementing the storage devices,such as solid-state memory, or magnetic disk or tape.

Monitoring center 20 comprises a metadata database (DB) 64, which holdsthe metadata of the intercepted communication sessions. The metadatastored in DB 64 may comprise, for example, transcriptions andannotations relating to the intercepted content and Call Data Records(CDRs). In addition, DB 64 holds references (e.g., pointers or paths)that indicate the current storage locations of the raw content instorage system 40. The references to the raw content storage locationsare typically maintained transparently of the actual physical locationsof the content in system 40.

Monitoring center 20 comprises an Information Lifecycle Management (ILM)server 68, which controls the storage of content in system 40. Inparticular, the ILM server decides in which storage tier to store eachcontent item. As conditions change, the ILM server may move contentitems from one storage tier to another. In some embodiments, ILM server68 selects the storage tier for a given content item based on theinvestigation case (or cases) with which this item is associated. Thestructure and operation of ILM server 68 is explained in greater detailbelow.

In the present context, the definitions or rules that specify whichstorage tier or tiers are to be used for storing the various contentitems are referred to as an ILM policy. In the disclosed techniques, thecontent items are associated with investigation cases, and the ILMpolicy depends on this association. In other words, the ILM serveranalyzes the state of a given investigation case, and then selects andapplies a suitable ILM policy for the items associated with this casebased on the state of the case. Thus, the terms “selecting a storagetier” and “selecting an ILM policy” are sometimes used interchangeablyherein.

Monitoring center 20 comprises an operator terminal 56, using which anoperator 60 is able to retrieve and analyze the content stored instorage system 40. Typically, the operator terminal comprises suitableinput and output devices for presenting the content to the operator andfor controlling the monitoring center by the operator. Typically, theoperator is able to view and analyze the metadata, as well.

In the present embodiment, DB 64 holds a list of investigation cases.For each investigation case, DB 64 holds references to the currentstorage locations (in system 40) of all raw data elements that areassociated with the case stored, as well as the metadata relating to thecase. Typically, a raw content element may belong to only one case.Thus, for example, if a certain intercepted call belongs to multiplecases, the call is duplicated and its content associated separately withthe different cases.

This technique enables each case to be analyzed separately and allowapplying case-based access rights. In these embodiments, an investigatorworking on one case is usually not permitted to have access toinformation gathered and analyzed in another case. If a call belongs totwo cases, the call will typically be handled totally separately withinthe context of each case, e.g., with separate transcriptions,annotations and analysis results.

Thus, DB 64 typically holds, for each case, a list of references to themetadata records associated with the case. A given metadata recordtypically holds a list of references to the current storage locations(in system 40) of the raw content elements.

Typically, when the ILM server moves content items from one storage tierto another, the metadata associated with these content items is notmoved. The ILM server updates the metadata to reflect the new storagelocations of the content items in the new storage tier. In a typicalembodiment, all content items of a given case are moved in a singletransaction. The transaction can be rolled back in case of failure.

FIG. 2 is a block diagram that schematically illustrates ILM server 68and its interaction with other elements of monitoring center 20, inaccordance with an embodiment of the present disclosure. ILM server 68comprises an interface 72 for communicating with other elements ofmonitoring center 20, e.g., with DB 64 and with storage system 40. TheILM server further comprises a processor 76 that carries out the methodsdescribed herein. In the present example, processor 76 runs severalsoftware modules, namely a mid-term service 80 and an archive/restoreservice 84. Service 84 comprises a restore Work Station (WS) 88 and anarchive WS 92 that are operated by operator 60.

Mid-term service 80 is responsible for moving content items betweenon-line storage tier 44 and mid-term storage tier 58. In a typical flow,based on the status of a given case the mid-term service queries themetadata of the calls related to this case in DB 64, as illustrated byan arrow 100. Based on the metadata (e.g., based on the investigationcase with which the call is associated), the mid-term service may decideto move the content of the call from on-line storage tier 44 to mid-termstorage tier 48. After copying the content item from tier 44 to tier 48(illustrated by an arrow 112), the mid-term service deletes the contentitem from tier 44 (illustrated by an arrow 108), and updates the path ofin the metadata stored in DB 64 (illustrated by an arrow 104) to reflectthe new storage location. Typically, the entire process of movingcontent items between storage tiers is transparent to operator 60.

A content item is typically deleted from a given storage tier only afterit is safely copied to its new location, to ensure data integrity. Inthese procedures (sometimes referred to as “make before break”), theduplicated content is first verified to be stored successfully in thenew location. Only afterwards, as a complete transaction (meaning thatall the content items were copied successfully), the old information isdeleted. If, for any reason, the copy process is interrupted or themetadata update fails, then the process is rolled-back: All the copiedinformation is deleted and the content is left in the original storagelocation.

Although the figure shows data flow from the on-line tier to themid-term tier, data flow in the opposite direction may also be allowed.In other words, the process above can be used to move content items fromthe mid-term storage tier to the on-line storage tier. This decision maybe based, for example, on the investigation case or cases with which thecontent is associated.

Archive/restore service 84 is responsible for moving content itemsbetween archive storage tier 52 and the other storage tiers. The exampleof FIG. 2 shows data flow from the mid-term storage tier to the archivestorage tier. Alternatively, however, service 84 may move data fromon-line storage tier to the archive storage tier, as well as from thearchive storage tier to any of the other storage tiers.

In the example flow of FIG. 2, archive WS 92 queries the metadata of acertain call in DB 64. Based on the metadata (e.g., based on theinvestigation case with which the call is associated), the ILM servermay decide to move the content of the call from mid-term storage tier 48to archive storage tier 52. After copying the content item from tier 48to tier 52 (illustrated by arrows 120 and 124), the ILM server deletesthe content item from tier 48 and updates the path of in the metadatastored in DB 64. In some embodiments, WS 92 archives a content item intier 52 by copying the content item to a local memory in server 68,producing an image to be written to archive tier 52, and then writingthe image from server 68 to tier 52. In some scenarios, operator 60 maycontrol this process, for example by returning data from WORM storage(e.g., CD, DVD or external storage).

In some embodiments, restore WS 88 restores content items from tier 52to tiers 44 and/or 48. In the present example, restore WS 88 queries themetadata of a certain call in DB 64. Based on the metadata (e.g., basedon the investigation case with which the call is associated), the ILMserver may decide to restore the content of the call from archivestorage tier 52 to on-line storage tier 44. After copying the contentitem from tier 52 to tier (illustrated by arrows 128 and 116), the ILMserver deletes the content item from tier 52 (if applicable) and updatesthe path of in the metadata stored in DB 64. In some embodiments, WS 88restores a content item from tier 52 by copying the image of the contentitem to a local memory in the ILM server, and restoring the content fromserver 68 to tier 44.

The monitoring center and ILM server configurations of FIGS. 1 and 2 areexample configurations, which are chosen purely for the sake ofconceptual clarity. In alternative embodiments, any other suitableconfigurations can be used. The monitoring center and ILM serverelements may be implemented using hardware, software or using acombination of hardware and software elements. Typically, ILM server 68(and in particular processor 84) comprises a general-purpose computer,which is programmed in software to carry out the functions describedherein. The software may be downloaded to the computer in electronicform, over a network, for example, or it may, alternatively oradditionally, be provided and/or stored on non-transitory tangiblemedia, such as magnetic, optical, or electronic memory.

Storage TIER Selection Based on Association with Investigation Cases

In some embodiments, the information in monitoring center 20 isorganized and managed in the context of investigation cases. A giveninvestigation case may relate to a certain individual or group ofindividuals, to an event or group of events, to a certain geographicallocation, for example. Alternatively, an investigation case may bedefined in any other suitable manner.

A given investigation case is typically associated with multiple calls,and therefore with multiple content items in storage system 40. Forexample, an investigation case that concerns a certain suspectindividual may be associated, for example, with the telephone callsconducted by this individual, the telephone calls conducted from theindividual's phone, the telephone calls in which the individual's namewas mentioned. Alternatively, any other suitable association criteriacan be defined and used. The association between a given call (and thusgiven content) and a given investigation case may be defined manually byoperator 60 or automatically. Generally, a given call (and thereforegiven content) may be associated with one or more investigation cases.

In some embodiments, ILM server 68 decides in which storage tier tostore given content (i.e., to select an ILM policy for the content)based on the investigation case (or cases) with which the content isassociated. Typically, the associations between content andinvestigation cases are stored in DB 64, and the ILM server queries thisinformation and moves content items from one storage tier to anotherbased on the queried associations. Newly-intercepted content willtypically be stored in on-line storage tier 44, and later moved to otherstorage tiers as necessary. In other words, the selection of storagetier may depend on the timing profiles according to which the contentitems were accessed.

ILM server 68 may apply any suitable criteria for selecting a storagetier for a given content item based on the investigation cases withwhich the item is associated. For example, a given investigation casetypically has a given activity status at a given time. For example, aninvestigation case may be defined as active or inactive (closed). Insome embodiments, ILM server 68 selects the storage tier for a givencontent item based on the activity statuses of the investigation caseswith which the item is associated.

In an example embodiment, server 68 stores all the content items thatare associated with an active investigation case in on-line storage tier44 or in mid-term storage tier 48. The content items that are associatedwith inactive investigation cases are stored in the archive storage tier52. When the activity status of a given investigation case changes, ILMserver 68 typically moves the content items of this case between thestorage tiers to match the new activity status. For example, whenoperator 60 closes a case, ILM server 68 typically moves the contentassociated with this case to the archive storage tier. When operator 60re-opens a case, the ILM server typically restores the content itemsassociated with this case from the archive tier to the mid-term oron-line tier.

Note that this sort of policy is distinctly different from selecting thestorage tier based on the activity status of the content itemsthemselves (e.g., based on when the content was most recently accessed).For example, old or rarely-accessed content may be associated with anactive investigation case, and therefore stored in the mid-term or evenon-line tier. A new or frequently-accessed content item may not beassociated with any active cases, and therefore be archived in thearchive tier. By selecting the storage tiers for the content items basedon the associated investigation cases, ILM server 68 is able to optimizethe usage of storage system 40 to the actual relevance of the content.As a result, both access time and system cost are optimized.

When a given content item is associated with two or more investigationcases, the ILM server may apply any suitable criteria for resolvingpossible contradictions. For example, if at least one of the casesassociated with a given content item is active, the ILM server may treatthis item as associated with an active case. If all the cases associatedwith a given content item are inactive, the ILM server will treat thisitem as associated with an inactive case. Alternatively, any othersuitable policy can be used.

In some embodiments, a given investigation case may have one or moresub-cases. The given investigation case is referred to as a parent casein this context. Each sub-case, as well as the parent case, may beassociated with a certain respective set of content items. The ILMserver may select the storage tier for a given content item based on theassociated case, and/or based on parent and sub-cases of this case.

In some embodiments, the investigation cases are assigned respectivepriorities. The priorities can be used, for example, for allocatingmonitoring center resources to the various cases. In these embodiments,ILM server 68 may select a storage tier for a given content item basedon the priority (or priorities) of the investigation case (or cases)associated with this item. Typically, content associated withhigh-priority cases will be given precedence over content associatedwith low-priority cases in access to resources.

Consider, for example, a configuration in which the size of on-linestorage tier 44 is limited. When competing for storage space in on-linetier 44, content that is associated with a high-priority case may begiven precedence over content that is associated with a low-prioritycase. Alternatively, the ILM server may use the priorities of theinvestigation cases in any other way to select storage tiers for contentitems.

In some embodiments, ILM server 68 applies the investigation-relatedcriteria described above in combination with other criteria. Forexample, the on-line storage tier may be used for storing content itemsassociated with active cases as well as content items intercepted in thelast N days. Alternatively, any other suitable criteria can be used.

Typically, the storage locations of the different content items aretransparent to operator 60, and are managed automatically by ILM server68.

FIG. 3 is a flow chart that schematically illustrates a method for ILM,in accordance with an embodiment of the present disclosure. The methodbegins with ILM server 68 querying DB 64 for the metadata of a certaincall, at a database querying step 130. In particular, the ILM serverobtains the investigation case with which the call content isassociated.

The ILM server checks whether the activity status of the investigationcase has changed, at a change checking step 134. In other words, the ILMserver checks whether the storage tier used for storing the content ofthe call matches the status of the investigation case. If the storagelocation matches the status, the method loops back to step 130 above.

Otherwise, the ILM server re-selects the storage tier for storing thecontent in question, at a re-selection step 138. The ILM server movesthe content items to the re-selected storage tier, at a content movingstep 142. The method then loops back to step 130 above.

Although the embodiments described herein refer mainly to storage inmultiple storage tiers having different respective access times, thedisclosed techniques can also be used with storage tiers that differfrom one another in other performance levels.

The disclosed techniques can be used in any application that involvesinvestigation cases, such as like Anti-Money Laundering (AML) systems atFinancial Investigation (FI) units, fraud investigation systems (e.g.,systems used also by telecom operators, insurance companies and otherorganizations), or any other suitable application. When using thedisclosed techniques in such applications, the data is organized byinvestigation cases, including both well-structured data such as CDRsand metadata, and non-structured content such as phone calls, e-mailmessages, transcriptions and call summaries. ILM is applied to all ofthese data types according to their association with investigationcases, e.g., based on the case activity status.

It will thus be appreciated that the embodiments described above arecited by way of example, and that the present disclosure is not limitedto what has been particularly shown and described hereinabove. Rather,the scope of the present disclosure includes both combinations andsub-combinations of the various features described hereinabove, as wellas variations and modifications thereof which would occur to personsskilled in the art upon reading the foregoing description and which arenot disclosed in the prior art. Documents incorporated by reference inthe present patent application are to be considered an integral part ofthe application except that to the extent any terms are defined in theseincorporated documents in a manner that conflicts with the definitionsmade explicitly or implicitly in the present specification, only thedefinitions in the present specification should be considered.

1. A method for Information Lifecycle Management (ILM), comprising:analyzing a state of an investigation case; selecting, based on theanalyzed state, an ILM policy for applying to items of data associatedwith the investigation case; and storing the items of data in a storagesystem having multiple storage tiers having different, respectiveperformance levels, in accordance with the ILM policy.
 2. The methodaccording to claim 1, wherein selecting the ILM policy compriseschoosing a respective storage tier for storing each item of data.
 3. Themethod according to claim 2, wherein selecting the ILM policy comprisesidentifying an activity status of the investigation case, and choosingthe storage tier depending on the activity status.
 4. The methodaccording to claim 1, wherein the performance levels of the multiplestorage tiers comprise different, respective access times.
 5. The methodaccording to claim 1, wherein the items comprise content that is derivedfrom communication sessions conducted over a communication network andmetadata associated with the content.
 6. The method according to claim5, wherein the metadata comprises references to a current storagelocation of the associated content in the storage system.
 7. The methodaccording to claim 5, wherein the items comprise additional items ofdata from an external source separate from the communication network. 8.The method according to claim 1, wherein storing the items in accordancewith the ILM policy comprises storing the items in a first storage tierhaving a first performance level when the investigation case is active,and storing the items in a second storage tier having a secondperformance level, lower than the first performance level, when theinvestigation case is inactive.
 9. The method according to claim 1,wherein storing the items in accordance with the ILM policy comprisesdetecting a change in the state of the investigation case, and movingthe items from a first storage tier to a second storage tier in responseto the change.
 10. The method according to claim 9, wherein the itemscomprise content and metadata associated with the content, and whereinmoving the items comprises moving only the content and not the metadataof the items, and updating the metadata of the items to reflect acurrent storage location of the items in the second storage tier. 11.The method according to claim 1, wherein the investigation case is oneof multiple investigation cases that are assigned respective priorities,and wherein storing the items in accordance with the ILM policycomprises choosing a storage tier for storing the items depending on apriority assigned to the investigation case.
 12. The method according toclaim 1, wherein selecting the ILM policy comprises choosing a storagetier for storing the items depending on a parent case or on a sub-caseof the investigation case.
 13. The method according to claim 1, whereinselecting the ILM policy comprises selecting a storage tier for storingthe items based on timing profiles according to which the data itemsassociated with the investigation case were accessed.
 14. The methodaccording to claim 1, wherein storing the items in accordance with theILM policy comprises copying content of all the items associated withthe investigation case from a first storage location to a second storagelocation in a single transaction, updating metadata associated with theitems following the transaction to indicate the second storage location,and, after updating the metadata, deleting the content from the firststorage location.
 15. The method according to claim 14, and comprisingrolling back the transaction upon failing to successfully complete thetransaction or to update the metadata.
 16. Apparatus for InformationLifecycle Management (ILM), comprising: a storage system, comprisingmultiple storage tiers having different, respective performance levels;and a processor, which is configured to analyze a state of aninvestigation case, to select, based on the analyzed state, an ILMpolicy for applying to items of data that are associated with theinvestigation case, and to store the items of data in the storage tiersof the storage system in accordance with the ILM policy.
 17. Theapparatus according to claim 16, wherein the processor is configured toselect the ILM policy by choosing a respective storage tier for storingeach item of data.
 18. The apparatus according to claim 17, wherein theprocessor is configured to identify an activity status of theinvestigation case, and to choose the storage tier depending on theactivity status.
 19. The apparatus according to claim 16, wherein theperformance levels of the multiple storage tiers comprise different,respective access times.
 20. The apparatus according to claim 16,wherein the items comprise content that is derived from communicationsessions conducted over a communication network and metadata associatedwith the content.